UNC6671 Linked to Vishing Attacks on Hedge Funds and Private Equity Firms

A wave of cyberattacks targeting hedge funds, private-equity companies and other financial organisations has been linked to the UNC6671 extortion group.

Recent reports said attackers targeted Point72 Asset Management, Millennium Management, Two Sigma Investments, Citadel and several private-equity firms. The campaigns reportedly relied on voice phishing, or vishing, to trick employees into giving attackers access to corporate systems.

Google’s Threat Intelligence Group, known as GTIG, tracks the activity under the UNC6671 label. The group previously operated publicly as BlackFile and has since used several extortion brands, according to Google.

Major financial firms face vishing attacks

Attackers reportedly contacted employees on personal mobile phones while posing as corporate helpdesk staff.

During the calls, the operators told targets that they needed to enrol passkeys or update multi-factor authentication settings. They then directed employees to fraudulent websites that impersonated their companies.

Those sites used adversary-in-the-middle phishing kits to capture usernames, passwords and session cookies in real time. Session cookies can allow attackers to bypass some authentication protections because they give access to an already authenticated account session.

Once the attackers obtained a Microsoft 365 or Okta single sign-on account, they could access cloud services linked to that account through the organisation’s SSO dashboard.

Google says the operators then use automated tools to collect data from cloud platforms. They may also delete security alerts and password-reset messages from compromised email inboxes to delay detection.

BlackFile reportedly shifted to financial targets

BlackFile first appeared in February 2025, when it targeted retail and hospitality organisations. Threat researchers say the group shifted its focus in July 2026 toward hedge funds, private-equity firms, large law firms and financial-rating agencies.

Before that shift, the operators reportedly targeted companies in manufacturing, healthcare, real estate, technology, transportation and hospitality.

Austin Larsen, a principal threat analyst at GTIG, said a single core intrusion group appears to drive the helpdesk vishing attacks and cloud data theft across multiple public extortion brands.

Google links the UNC6671 extortion group to BlackFile, Redact, Pink, Helix and Falcon. BlackFile announced in May that it would rebrand as Redact.

GTIG tracked more than $10.6 million in Bitcoin payments to group wallets between January and May 2026, according to Larsen. The operators may initially demand more than $3 million, but Google says they often settle around $750,000 after negotiations.

Falcon disputes the wider attribution

The Falcon extortion group has challenged parts of the threat intelligence reporting.

In a statement published on its data leak site, Falcon claimed that it works exclusively as a Redact affiliate. The group denied sharing operators, infrastructure, tools, negotiation channels or proceeds with Helix, Pink or other groups named in the analysis.

Threat actors often make public claims that serve their own interests, so researchers must treat such statements with caution.

Mandiant says it is helping several dozen organisations that UNC6671 has compromised. The company also says the group uses infrastructure and domain registration patterns that differ from those linked to Scattered Spider, despite similarities in their helpdesk social-engineering tactics.

Security teams should track the UNC6671 extortion group closely, as its voice-phishing tactics can quickly lead to cloud-account compromise and data theft. Strong phishing-resistant authentication, strict session controls and rapid alert reviews can also limit the damage when attackers target cloud identities.